Behavioral task
behavioral1
Sample
bdced8b193bc1fb89478e4857c1a65fdd8fdcaab0dbcf163a2678790855838ce.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bdced8b193bc1fb89478e4857c1a65fdd8fdcaab0dbcf163a2678790855838ce.exe
Resource
win10v2004-20240226-en
General
-
Target
f38373a769d5f63cdfb33efa4d98fbfc.bin
-
Size
138KB
-
MD5
7a03c56ebaccfa5f65e76641ceec6c2b
-
SHA1
e0b5a466cb309c78c719cc1c6df80da296e1bbdd
-
SHA256
ce21f3957069af116935a48571554e3c3b82a0d59ba8c354f756b372b19f8d11
-
SHA512
42d5dd6951b0fbc7520e82c3b21310c592034a8704028bbadd35276d1dc5ea48c3471ccb2a153316cecbbcc0441af21e5d59c0129ea42774fed0372da31782af
-
SSDEEP
3072:vfn1IUUzTusgFp03CWr7H3SHRuTmX+QRDgeh7K6Zhk:vfhUz0R8zlmuKDHhk
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule static1/unpack001/bdced8b193bc1fb89478e4857c1a65fdd8fdcaab0dbcf163a2678790855838ce.exe family_blackmoon -
resource yara_rule static1/unpack001/bdced8b193bc1fb89478e4857c1a65fdd8fdcaab0dbcf163a2678790855838ce.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/bdced8b193bc1fb89478e4857c1a65fdd8fdcaab0dbcf163a2678790855838ce.exe
Files
-
f38373a769d5f63cdfb33efa4d98fbfc.bin.zip
Password: infected
-
bdced8b193bc1fb89478e4857c1a65fdd8fdcaab0dbcf163a2678790855838ce.exe.exe windows:4 windows x86 arch:x86
Password: infected
da4a387004bf1285d93edaa4d5233098
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegQueryValueExA
RegCloseKey
RegOpenKeyA
RegCloseKey
atl
AtlAxWinInit
AtlUnadvise
AtlAdvise
AtlAxGetControl
AtlAxGetControl
gdi32
SetTextColor
DeleteObject
CreateSolidBrush
SelectObject
DeleteDC
Rectangle
StretchBlt
GetPixel
GetObjectA
ExtCreateRegion
CombineRgn
CreateRoundRectRgn
CreatePatternBrush
FillRgn
FrameRgn
SetBkColor
CreateFontA
GetStockObject
kernel32
LCMapStringA
LoadLibraryA
GetProcAddress
FreeLibrary
GetCommandLineA
GetTickCount
WritePrivateProfileStringA
WriteFile
GetPrivateProfileStringA
GetUserDefaultLCID
DeleteFileA
CreateFileA
GetFileSize
ReadFile
IsBadReadPtr
HeapReAlloc
ExitProcess
HeapAlloc
HeapFree
GetProcessHeap
lstrlenW
GetWindowsDirectoryA
SetHandleCount
lstrcpyn
GlobalSize
lstrcpyn
GetCurrentProcessId
TerminateProcess
OpenProcess
MulDiv
GlobalUnlock
RtlMoveMemory
GlobalLock
GlobalAlloc
WideCharToMultiByte
Module32First
Process32Next
Process32First
CreateToolhelp32Snapshot
CancelWaitableTimer
SetWaitableTimer
CreateWaitableTimerA
GetModuleFileNameA
GetTempPathA
GetModuleHandleA
GlobalFree
CloseHandle
TerminateThread
MultiByteToWideChar
GetModuleHandleA
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
msimg32
AlphaBlend
TransparentBlt
AlphaBlend
msvcrt
strncmp
sprintf
tolower
??2@YAPAXI@Z
??3@YAXPAX@Z
strchr
strrchr
strncpy
atoi
_ftol
floor
strtod
_CIfmod
toupper
srand
rand
memmove
modf
free
malloc
__CxxFrameHandler
_strnicmp
atoi
oleaut32
VariantChangeType
VariantInit
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
VarR8FromCy
VarR8FromI2
LoadTypeLib
LHashValOfNameSys
RegisterTypeLib
SafeArrayCreate
SysAllocString
VariantClear
SafeArrayDestroy
OleLoadPicture
OleLoadPicture
shell32
DragAcceptFiles
DragQueryFile
DragFinish
Shell_NotifyIcon
ShellExecuteA
DragFinish
shlwapi
PathFileExistsA
PathFileExistsA
user32
ValidateRect
ScreenToClient
GetWindowRect
GetFocus
SetFocus
GetDlgItem
CreateWindowExA
DestroyIcon
PostQuitMessage
UpdateWindow
TrackMouseEvent
SetCursor
LoadCursorA
MsgWaitForMultipleObjects
GetIconInfo
DefMDIChildProcA
SendMessageA
DefWindowProcA
DestroyIcon
MoveWindow
CreateMenu
CreatePopupMenu
SetWindowPos
LoadMenuA
PeekMessageA
wsprintfA
SetMenuDefaultItem
SetMenuItemBitmaps
SetMenuItemInfoA
CheckMenuItem
RemoveMenu
MenuItemFromPoint
GetMenuDefaultItem
GetMenuInfo
GetMenuState
GetWindowTextLengthA
GetMenuItemInfoA
GetMenuStringA
TrackPopupMenu
SetForegroundWindow
CheckMenuRadioItem
GetMenuItemID
GetSubMenu
SetMenuInfo
InsertMenuA
GetMenuItemCount
AppendMenuA
PostMessageA
EnableWindow
SetParent
ShowWindow
IsWindowEnabled
GetSystemMenu
GetAsyncKeyState
EndPaint
BeginPaint
GetClassNameA
IsWindow
DispatchMessageA
TranslateMessage
IsDialogMessage
TranslateAccelerator
GetMessageA
KillTimer
SetTimer
CallWindowProcA
FillRect
GetClientRect
InvalidateRect
GetAncestor
GetParent
CopyIcon
CopyImage
SetLayeredWindowAttributes
SetWindowLongA
GetWindowLongA
GetWindowTextA
IsWindowVisible
GetWindowThreadProcessId
SetWindowTextA
MessageBoxA
SetPropA
GetPropA
RemovePropA
SetWindowRgn
SetRect
GetClassLongA
SetClassLongA
GetSysColor
IsIconic
IsZoomed
GetSystemMetrics
GetMenu
SetMenu
DrawMenuBar
RegisterWindowMessageA
RegisterHotKey
UnregisterHotKey
SetActiveWindow
RegisterClassExA
DrawTextA
UpdateLayeredWindow
DrawIcon
GetMenuItemRect
DrawIconEx
GetWindow
GetDesktopWindow
DestroyMenu
LoadCursorA
RegisterClassExA
wininet
HttpQueryInfoA
InternetReadFile
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetCloseHandle
InternetOpenA
InternetOpenA
gdiplus
GdipDisposeImage
GdipCreateBitmapFromStream
GdipSaveImageToStream
GdiplusShutdown
GdipCreateBitmapFromStreamICM
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipGetImageRawFormat
GdipGetImageGraphicsContext
GdipCreateSolidFill
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipCreateStringFormat
GdipGetFontHeight
GdipGetFontUnit
GdipGetFontSize
GdipGetFontStyle
GdipCreateFontFromDC
GdipCreateFont
GdipDeleteFont
GdipImageSelectActiveFrame
GdipLoadImageFromStream
GdipDrawString
GdipDrawImagePointRect
GdipFillRectangle
GdipGetImageDimension
GdipCreateBitmapFromScan0
GdipDeletePen
GdipDrawLine
GdipCreatePen1
GdipDeleteGraphics
GdipDrawImageRect
GdipGetImageWidth
GdipGetImageHeight
GdipCreateFromHDC
GdipDrawRectangleI
GdipDrawRectangle
GdipGetTextRenderingHint
GdipSetTextRenderingHint
GdipGetSmoothingMode
GdipSetSmoothingMode
GdipSetWorldTransform
GdipDeleteBrush
GdiplusStartup
GdipDrawLine
ole32
CoInitialize
OleRun
OleRun
combase
CoUninitialize
CreateStreamOnHGlobal
GetHGlobalFromStream
StringFromGUID2
CoCreateInstance
CLSIDFromProgID
CLSIDFromString
Sections
UPX0 Size: 412KB - Virtual size: 412KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
UPX1 Size: 88KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
UPX2 Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE